CVE-2009-2993
acroread: Multiple arbitrary code execution fixes in 8.1.7 (APSB09-15)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 does not properly implement the (1) Privileged Context and (2) Safe Path restrictions for unspecified JavaScript methods, which allows remote attackers to create arbitrary files, and possibly execute arbitrary code, via the cPath parameter in a crafted PDF file. NOTE: some of these details are obtained from third party information.
JavaScript en la API de Acrobat de Adobe Reader y Acrobat v7.x anteriores a v7.1.4, v8.x anteriores a v8.1.7 y v9.x anteriores a v9.2 no implementa apropiadamente el (1) "Privileged Context" (contexto privilegidado) y (2) restricciones de "Safe Path" (ruta segura) para métodos de JavaScript sin especificar. Lo que permite a atacantes remotos crear ficheros de su elección, y posiblemente ejecutar código de su elección, a través del parámetro cPath en un fichero PDF modificado. NOTA: algunos de estos detalles han sido obtenidos de información de terceras partes.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-08-27 CVE Reserved
- 2009-10-19 CVE Published
- 2024-08-07 CVE Updated
- 2024-09-25 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (10)
URL | Tag | Source |
---|---|---|
http://securitytracker.com/id?1023007 | Vdb Entry | |
http://www.securityfocus.com/bid/36638 | Vdb Entry | |
http://www.securityfocus.com/bid/36664 | Vdb Entry | |
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5822 | Signature |
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
http://www.adobe.com/support/security/bulletins/apsb09-15.html | 2018-10-30 | |
http://www.kb.cert.org/vuls/id/257117 | 2018-10-30 | |
http://www.us-cert.gov/cas/techalerts/TA09-286B.html | 2018-10-30 | |
http://www.vupen.com/english/advisories/2009/2898 | 2018-10-30 |
URL | Date | SRC |
---|---|---|
https://access.redhat.com/security/cve/CVE-2009-2993 | 2009-10-14 | |
https://bugzilla.redhat.com/show_bug.cgi?id=528659 | 2009-10-14 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | <= 9.1.3 Search vendor "Adobe" for product "Acrobat" and version " <= 9.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0 Search vendor "Adobe" for product "Acrobat" and version "7.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.1 Search vendor "Adobe" for product "Acrobat" and version "7.0.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.2 Search vendor "Adobe" for product "Acrobat" and version "7.0.2" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.3 Search vendor "Adobe" for product "Acrobat" and version "7.0.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.4 Search vendor "Adobe" for product "Acrobat" and version "7.0.4" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.5 Search vendor "Adobe" for product "Acrobat" and version "7.0.5" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.6 Search vendor "Adobe" for product "Acrobat" and version "7.0.6" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.7 Search vendor "Adobe" for product "Acrobat" and version "7.0.7" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.8 Search vendor "Adobe" for product "Acrobat" and version "7.0.8" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.0.9 Search vendor "Adobe" for product "Acrobat" and version "7.0.9" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.1.0 Search vendor "Adobe" for product "Acrobat" and version "7.1.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.1.1 Search vendor "Adobe" for product "Acrobat" and version "7.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 7.1.3 Search vendor "Adobe" for product "Acrobat" and version "7.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.0 Search vendor "Adobe" for product "Acrobat" and version "8.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1 Search vendor "Adobe" for product "Acrobat" and version "8.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1.1 Search vendor "Adobe" for product "Acrobat" and version "8.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1.2 Search vendor "Adobe" for product "Acrobat" and version "8.1.2" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1.3 Search vendor "Adobe" for product "Acrobat" and version "8.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1.4 Search vendor "Adobe" for product "Acrobat" and version "8.1.4" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 8.1.6 Search vendor "Adobe" for product "Acrobat" and version "8.1.6" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 9.0 Search vendor "Adobe" for product "Acrobat" and version "9.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 9.1.1 Search vendor "Adobe" for product "Acrobat" and version "9.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Search vendor "Adobe" for product "Acrobat" | 9.1.2 Search vendor "Adobe" for product "Acrobat" and version "9.1.2" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | <= 9.1.3 Search vendor "Adobe" for product "Acrobat Reader" and version " <= 9.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.1 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.2 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.2" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.3 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.4 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.4" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.5 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.5" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.6 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.6" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.7 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.7" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.8 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.8" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.0.9 Search vendor "Adobe" for product "Acrobat Reader" and version "7.0.9" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.1.0 Search vendor "Adobe" for product "Acrobat Reader" and version "7.1.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.1.1 Search vendor "Adobe" for product "Acrobat Reader" and version "7.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 7.1.3 Search vendor "Adobe" for product "Acrobat Reader" and version "7.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.0 Search vendor "Adobe" for product "Acrobat Reader" and version "8.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.1 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.2 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.2" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.3 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.3" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.4 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.4" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.5 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.5" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 8.1.6 Search vendor "Adobe" for product "Acrobat Reader" and version "8.1.6" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 9.0 Search vendor "Adobe" for product "Acrobat Reader" and version "9.0" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 9.1 Search vendor "Adobe" for product "Acrobat Reader" and version "9.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 9.1.1 Search vendor "Adobe" for product "Acrobat Reader" and version "9.1.1" | - |
Affected
| ||||||
Adobe Search vendor "Adobe" | Acrobat Reader Search vendor "Adobe" for product "Acrobat Reader" | 9.1.2 Search vendor "Adobe" for product "Acrobat Reader" and version "9.1.2" | - |
Affected
|